Microsoft doesn’t set a passing Secure Score. It is more useful as a to-do list than a grade, so focus on the handful of actions that remove the most real risk.
Key Takeaways
- Microsoft doesn’t publish a passing score, and a high score doesn’t mean you can’t be breached.
- Compare your progress over time, and prioritize by real risk, not by points.
- Your score reflects your licenses and choices, so scores can’t be compared fairly across companies.
What Secure Score measures
Microsoft Secure Score, in the Microsoft Defender portal, is a percentage of the points available for the security actions Microsoft recommends for your tenant. You earn points as you complete actions. Most actions are all-or-nothing, while some give partial credit, such as the share of users covered by MFA.
Microsoft is clear that it isn’t an absolute measure of how likely you are to be breached. It shows how much of Microsoft’s recommended configuration you’ve adopted.
What is a good Secure Score?
Microsoft doesn’t set a passing number. Your available points depend on your licenses, so one company’s 60% can’t be fairly compared with another’s.
The better question is whether the high-impact actions are finished. A company with a lower score and strong admin and MFA controls can be better protected than one with a higher score and an unprotected admin account. Set your own target, watch the trend, and be able to explain any action you’ve decided not to take.
What to fix first
Secure Score sorts by points. We’d sort by what attackers actually use:
- Require MFA for admins, then for all users.
- Block legacy authentication.
- Reduce the number of Global Admins, and use separate admin accounts.
- Limit which apps users can consent to.
- Turn on anti-phishing, Safe Links, and Safe Attachments, if licensed.
- Block automatic external email forwarding.
- Restrict external sharing defaults in SharePoint and OneDrive.
- Enforce device compliance through Intune, as a planned project.
Don’t chase points blindly
Some recommendations don’t fit every company, and some can disrupt work if you turn them on without testing. Roll out access changes in report-only mode first. If an action doesn’t apply, mark it as risk accepted or resolved through a third party and write down why. Then the score stays honest, and you have an answer ready if someone asks.
For the settings Secure Score doesn’t fully cover, use our Microsoft 365 security audit checklist.